Remote DoS attack against Microsoft SQL Server 7.0

From: Kevork Belian (kbelian@BUSINESS-SOFT.COM)
Date: Wed Nov 17 1999 - 06:20:45 PST

Next message: Anonymous: "(no subject)"

Previous message: Bronek Kozicki: "Re: WordPad/riched20.dll buffer overflow"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi,
I'm not sure whether this has been already reported (though I couldn't find
relevant information).
MS SQL Server 7.0 silently crashes when sent a TCP packet containing more
than 2 NULLs as data.

Description:
I tested this on a machine running SQL Server version 7.00.699. The NT box
is running NT Server with SP 4 (I don't think the Service Pack is an issue
since NT is not affected).
If the TCP/IP net library is enabled, the 3 or greater NULL bytes crach SQL
Server listening on port 1433. The SQL server raises an event 17055 with
fatal exception EXCEPTION_ACCESS VIOLATION.

Can anyone reproduce this?

It's interesting to mention that:
    - 1 or 2 NULL bytes don't affect the system.
    - A nornal service restart will reboot SQL Server


rgrds
Kevork Belian

Next message: Anonymous: "(no subject)"
Previous message: Bronek Kozicki: "Re: WordPad/riched20.dll buffer overflow"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:13:28 PDT